2008-05-07 08:33:00 -05:00
|
|
|
#
|
2020-05-06 02:11:17 -05:00
|
|
|
# VERSION 31 - DO NOT REMOVE THIS LINE
|
2012-06-06 21:54:16 -05:00
|
|
|
#
|
|
|
|
|
# This file may be overwritten on upgrades.
|
2008-05-07 08:33:00 -05:00
|
|
|
#
|
0000-12-31 18:09:24 -05:50
|
|
|
|
2017-03-09 05:14:21 -06:00
|
|
|
# Load lookup_identity module in case it has not been loaded yet
|
|
|
|
|
# The module is used to search users according the certificate.
|
|
|
|
|
<IfModule !lookup_identity_module>
|
|
|
|
|
LoadModule lookup_identity_module modules/mod_lookup_identity.so
|
|
|
|
|
</IfModule>
|
0000-12-31 18:09:24 -05:50
|
|
|
|
2017-03-09 05:14:21 -06:00
|
|
|
ProxyRequests Off
|
2010-08-03 18:42:03 -05:00
|
|
|
|
|
|
|
|
#We use xhtml, a file format that the browser validates
|
2010-11-18 20:17:14 -06:00
|
|
|
DirectoryIndex index.html
|
2010-08-03 18:42:03 -05:00
|
|
|
|
|
|
|
|
|
2012-06-14 10:15:30 -05:00
|
|
|
# Substantially increase the request field size to support MS-PAC
|
|
|
|
|
# requests, ticket #2767. This should easily support a 64KiB PAC.
|
|
|
|
|
LimitRequestFieldSize 100000
|
2010-08-03 18:42:03 -05:00
|
|
|
|
2017-03-20 02:47:56 -05:00
|
|
|
# Increase connection keep alive time. Default value is 5 seconds, which is too
|
|
|
|
|
# short for interactive ipa commands. 30 seconds is a good compromise.
|
|
|
|
|
KeepAlive On
|
|
|
|
|
KeepAliveTimeout 30
|
|
|
|
|
|
2008-02-21 15:25:09 -06:00
|
|
|
# ipa-rewrite.conf is loaded separately
|
2007-10-19 09:14:30 -05:00
|
|
|
|
2013-12-04 09:15:20 -06:00
|
|
|
# Proper header for .tff fonts
|
|
|
|
|
AddType application/x-font-ttf ttf
|
2012-12-04 06:24:58 -06:00
|
|
|
|
|
|
|
|
# Enable compression
|
|
|
|
|
AddOutputFilterByType DEFLATE text/html text/plain text/xml \
|
2013-12-04 09:15:20 -06:00
|
|
|
application/javascript application/json text/css \
|
|
|
|
|
application/x-font-ttf
|
2012-12-04 06:24:58 -06:00
|
|
|
|
2010-02-24 12:29:23 -06:00
|
|
|
# FIXME: WSGISocketPrefix is a server-scope directive. The mod_wsgi package
|
|
|
|
|
# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
|
2017-03-29 03:33:32 -05:00
|
|
|
WSGISocketPrefix $WSGI_PREFIX_DIR
|
2009-10-26 06:16:18 -05:00
|
|
|
|
2007-09-10 15:33:01 -05:00
|
|
|
|
2010-02-24 12:29:23 -06:00
|
|
|
# Configure mod_wsgi handler for /ipa
|
2018-06-14 10:04:13 -05:00
|
|
|
WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
|
2017-11-17 04:42:33 -06:00
|
|
|
user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
|
|
|
|
|
lang=C.UTF-8 locale=C.UTF-8
|
2010-02-24 12:29:23 -06:00
|
|
|
WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
|
|
|
|
|
WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py
|
|
|
|
|
WSGIScriptReloading Off
|
2009-11-02 15:16:27 -06:00
|
|
|
|
2009-10-26 06:16:18 -05:00
|
|
|
|
2010-02-24 12:29:23 -06:00
|
|
|
# Turn off mod_msgi handler for errors, config, crl:
|
2010-02-23 11:53:47 -06:00
|
|
|
<Location "/ipa/errors">
|
|
|
|
|
SetHandler None
|
|
|
|
|
</Location>
|
|
|
|
|
<Location "/ipa/config">
|
|
|
|
|
SetHandler None
|
|
|
|
|
</Location>
|
|
|
|
|
<Location "/ipa/crl">
|
|
|
|
|
SetHandler None
|
|
|
|
|
</Location>
|
|
|
|
|
|
2012-02-15 09:26:42 -06:00
|
|
|
# Protect /ipa and everything below it in webspace with Apache Kerberos auth
|
|
|
|
|
<Location "/ipa">
|
2015-03-30 03:17:55 -05:00
|
|
|
AuthType GSSAPI
|
add session manager and cache krb auth
This patch adds a session manager and support for caching
authentication in the session. Major elements of the patch are:
* Add a session manager to support cookie based sessions which
stores session data in a memcached entry.
* Add ipalib/krb_utils.py which contains functions to parse ccache
names, format principals, format KRB timestamps, and a KRB_CCache
class which reads ccache entry and allows one to extract information
such as the principal, credentials, credential timestamps, etc.
* Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
that all kerberos items are co-located.
* Modify javascript in ipa.js so that the IPA.command() RPC call
checks for authentication needed error response and if it receives
it sends a GET request to /ipa/login URL to refresh credentials.
* Add session_auth_duration config item to constants.py, used to
configure how long a session remains valid.
* Add parse_time_duration utility to ipalib/util.py. Used to parse the
session_auth_duration config item.
* Update the default.conf.5 man page to document session_auth_duration
config item (also added documentation for log_manager config items
which had been inadvertantly omitted from a previous commit).
* Add SessionError object to ipalib/errors.py
* Move Kerberos protection in Apache config from /ipa to /ipa/xml and
/ipa/login
* Add SessionCCache class to session.py to manage temporary Kerberos
ccache file in effect for the duration of an RPC command.
* Adds a krblogin plugin used to implement the /ipa/login
handler. login handler sets the session expiration time, currently
60 minutes or the expiration of the TGT, whichever is shorter. It
also copies the ccache provied by mod_auth_kerb into the session
data. The json handler will later extract and validate the ccache
belonging to the session.
* Refactored the WSGI handlers so that json and xlmrpc could have
independent behavior, this also moves where create and destroy
context occurs, now done in the individual handler rather than the
parent class.
* The json handler now looks up the session data, validates the ccache
bound to the session, if it's expired replies with authenicated
needed error.
* Add documentation to session.py. Fully documents the entire process,
got questions, read the doc.
* Add exclusions to make-lint as needed.
2012-02-06 12:29:56 -06:00
|
|
|
AuthName "Kerberos Login"
|
2016-08-19 08:23:55 -05:00
|
|
|
GssapiUseSessions On
|
|
|
|
|
Session On
|
|
|
|
|
SessionCookieName ipa_session path=/ipa;httponly;secure;
|
|
|
|
|
SessionHeader IPASESSION
|
2017-06-06 08:04:58 -05:00
|
|
|
# Uncomment the following to have shorter sessions, but beware this may break
|
|
|
|
|
# old IPA client tols that incorrectly parse cookies.
|
|
|
|
|
# SessionMaxAge 1800
|
2017-03-29 03:33:32 -05:00
|
|
|
GssapiSessionKey file:$GSSAPI_SESSION_KEY
|
2016-08-19 08:23:55 -05:00
|
|
|
|
2017-03-09 05:14:21 -06:00
|
|
|
GssapiImpersonate On
|
2017-03-29 03:33:32 -05:00
|
|
|
GssapiDelegCcacheDir $IPA_CCACHES
|
2016-08-16 08:03:19 -05:00
|
|
|
GssapiDelegCcachePerms mode:0660 gid:ipaapi
|
2015-03-30 03:17:55 -05:00
|
|
|
GssapiUseS4U2Proxy on
|
2015-07-17 05:40:29 -05:00
|
|
|
GssapiAllowedMech krb5
|
add session manager and cache krb auth
This patch adds a session manager and support for caching
authentication in the session. Major elements of the patch are:
* Add a session manager to support cookie based sessions which
stores session data in a memcached entry.
* Add ipalib/krb_utils.py which contains functions to parse ccache
names, format principals, format KRB timestamps, and a KRB_CCache
class which reads ccache entry and allows one to extract information
such as the principal, credentials, credential timestamps, etc.
* Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
that all kerberos items are co-located.
* Modify javascript in ipa.js so that the IPA.command() RPC call
checks for authentication needed error response and if it receives
it sends a GET request to /ipa/login URL to refresh credentials.
* Add session_auth_duration config item to constants.py, used to
configure how long a session remains valid.
* Add parse_time_duration utility to ipalib/util.py. Used to parse the
session_auth_duration config item.
* Update the default.conf.5 man page to document session_auth_duration
config item (also added documentation for log_manager config items
which had been inadvertantly omitted from a previous commit).
* Add SessionError object to ipalib/errors.py
* Move Kerberos protection in Apache config from /ipa to /ipa/xml and
/ipa/login
* Add SessionCCache class to session.py to manage temporary Kerberos
ccache file in effect for the duration of an RPC command.
* Adds a krblogin plugin used to implement the /ipa/login
handler. login handler sets the session expiration time, currently
60 minutes or the expiration of the TGT, whichever is shorter. It
also copies the ccache provied by mod_auth_kerb into the session
data. The json handler will later extract and validate the ccache
belonging to the session.
* Refactored the WSGI handlers so that json and xlmrpc could have
independent behavior, this also moves where create and destroy
context occurs, now done in the individual handler rather than the
parent class.
* The json handler now looks up the session data, validates the ccache
bound to the session, if it's expired replies with authenicated
needed error.
* Add documentation to session.py. Fully documents the entire process,
got questions, read the doc.
* Add exclusions to make-lint as needed.
2012-02-06 12:29:56 -06:00
|
|
|
Require valid-user
|
|
|
|
|
ErrorDocument 401 /ipa/errors/unauthorized.html
|
2015-06-23 10:01:00 -05:00
|
|
|
WSGIProcessGroup ipa
|
|
|
|
|
WSGIApplicationGroup ipa
|
2016-03-10 11:32:50 -06:00
|
|
|
Header always append X-Frame-Options DENY
|
|
|
|
|
Header always append Content-Security-Policy "frame-ancestors 'none'"
|
2017-02-16 12:29:10 -06:00
|
|
|
|
|
|
|
|
# mod_session always sets two copies of the cookie, and this confuses our
|
|
|
|
|
# legacy clients, the unset here works because it ends up unsetting only one
|
|
|
|
|
# of the 2 header tables set by mod_session, leaving the other intact
|
|
|
|
|
Header unset Set-Cookie
|
2018-01-22 15:10:48 -06:00
|
|
|
|
|
|
|
|
# Disable etag http header. Doesn't work well with mod_deflate
|
|
|
|
|
# https://issues.apache.org/bugzilla/show_bug.cgi?id=45023
|
|
|
|
|
# Usage of last-modified header and modified-since validator is sufficient.
|
|
|
|
|
Header unset ETag
|
|
|
|
|
FileETag None
|
add session manager and cache krb auth
This patch adds a session manager and support for caching
authentication in the session. Major elements of the patch are:
* Add a session manager to support cookie based sessions which
stores session data in a memcached entry.
* Add ipalib/krb_utils.py which contains functions to parse ccache
names, format principals, format KRB timestamps, and a KRB_CCache
class which reads ccache entry and allows one to extract information
such as the principal, credentials, credential timestamps, etc.
* Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
that all kerberos items are co-located.
* Modify javascript in ipa.js so that the IPA.command() RPC call
checks for authentication needed error response and if it receives
it sends a GET request to /ipa/login URL to refresh credentials.
* Add session_auth_duration config item to constants.py, used to
configure how long a session remains valid.
* Add parse_time_duration utility to ipalib/util.py. Used to parse the
session_auth_duration config item.
* Update the default.conf.5 man page to document session_auth_duration
config item (also added documentation for log_manager config items
which had been inadvertantly omitted from a previous commit).
* Add SessionError object to ipalib/errors.py
* Move Kerberos protection in Apache config from /ipa to /ipa/xml and
/ipa/login
* Add SessionCCache class to session.py to manage temporary Kerberos
ccache file in effect for the duration of an RPC command.
* Adds a krblogin plugin used to implement the /ipa/login
handler. login handler sets the session expiration time, currently
60 minutes or the expiration of the TGT, whichever is shorter. It
also copies the ccache provied by mod_auth_kerb into the session
data. The json handler will later extract and validate the ccache
belonging to the session.
* Refactored the WSGI handlers so that json and xlmrpc could have
independent behavior, this also moves where create and destroy
context occurs, now done in the individual handler rather than the
parent class.
* The json handler now looks up the session data, validates the ccache
bound to the session, if it's expired replies with authenicated
needed error.
* Add documentation to session.py. Fully documents the entire process,
got questions, read the doc.
* Add exclusions to make-lint as needed.
2012-02-06 12:29:56 -06:00
|
|
|
</Location>
|
|
|
|
|
|
2016-08-19 08:23:55 -05:00
|
|
|
# Target for login with internal connections
|
|
|
|
|
Alias /ipa/session/cookie "/usr/share/ipa/gssapi.login"
|
2012-06-06 21:54:16 -05:00
|
|
|
|
2018-06-26 03:24:00 -05:00
|
|
|
# Turn off Apache authentication for i18n messages
|
|
|
|
|
<Location "/ipa/i18n_messages">
|
|
|
|
|
Require all granted
|
|
|
|
|
</Location>
|
|
|
|
|
|
2016-08-19 08:23:55 -05:00
|
|
|
# Turn off Apache authentication for password/token based login pages
|
2012-02-25 12:39:19 -06:00
|
|
|
<Location "/ipa/session/login_password">
|
2012-02-15 09:26:42 -06:00
|
|
|
Satisfy Any
|
2018-11-15 14:03:11 -06:00
|
|
|
Require all granted
|
2010-02-24 12:29:23 -06:00
|
|
|
</Location>
|
|
|
|
|
|
2017-03-09 05:14:21 -06:00
|
|
|
# Login with user certificate/smartcard configuration
|
|
|
|
|
# This configuration needs to be loaded after <Location "/ipa">
|
|
|
|
|
<Location "/ipa/session/login_x509">
|
|
|
|
|
AuthType none
|
2017-03-29 03:33:32 -05:00
|
|
|
GssapiDelegCcacheDir $IPA_CCACHES
|
2017-03-09 05:14:21 -06:00
|
|
|
GssapiDelegCcachePerms mode:0660 gid:ipaapi
|
2018-01-08 12:56:24 -06:00
|
|
|
SSLVerifyClient require
|
|
|
|
|
SSLUserName SSL_CLIENT_CERT
|
2017-03-09 05:14:21 -06:00
|
|
|
LookupUserByCertificate On
|
2017-04-10 06:11:13 -05:00
|
|
|
LookupUserByCertificateParamName "username"
|
2017-03-09 05:14:21 -06:00
|
|
|
WSGIProcessGroup ipa
|
|
|
|
|
WSGIApplicationGroup ipa
|
|
|
|
|
GssapiImpersonate On
|
|
|
|
|
|
|
|
|
|
GssapiUseSessions On
|
|
|
|
|
Session On
|
|
|
|
|
SessionCookieName ipa_session path=/ipa;httponly;secure;
|
|
|
|
|
SessionHeader IPASESSION
|
|
|
|
|
SessionMaxAge 1800
|
2017-03-29 03:33:32 -05:00
|
|
|
GssapiSessionKey file:$GSSAPI_SESSION_KEY
|
2017-03-09 05:14:21 -06:00
|
|
|
|
|
|
|
|
Header unset Set-Cookie
|
|
|
|
|
</Location>
|
|
|
|
|
|
2012-06-06 07:38:08 -05:00
|
|
|
<Location "/ipa/session/change_password">
|
|
|
|
|
Satisfy Any
|
2018-11-15 14:03:11 -06:00
|
|
|
Require all granted
|
2012-06-06 07:38:08 -05:00
|
|
|
</Location>
|
|
|
|
|
|
2014-05-28 10:38:40 -05:00
|
|
|
<Location "/ipa/session/sync_token">
|
|
|
|
|
Satisfy Any
|
2018-11-15 14:03:11 -06:00
|
|
|
Require all granted
|
2014-05-28 10:38:40 -05:00
|
|
|
</Location>
|
|
|
|
|
|
2015-05-08 12:39:29 -05:00
|
|
|
# Custodia stuff is redirected to the custodia daemon
|
|
|
|
|
# after authentication
|
|
|
|
|
<Location "/ipa/keys/">
|
2017-03-29 03:33:32 -05:00
|
|
|
ProxyPass "unix:${IPA_CUSTODIA_SOCKET}|http://localhost/keys/"
|
2015-05-08 12:39:29 -05:00
|
|
|
RequestHeader set GSS_NAME %{GSS_NAME}s
|
|
|
|
|
RequestHeader set REMOTE_USER %{REMOTE_USER}s
|
|
|
|
|
</Location>
|
|
|
|
|
|
2010-02-23 11:53:47 -06:00
|
|
|
# This is where we redirect on failed auth
|
|
|
|
|
Alias /ipa/errors "/usr/share/ipa/html"
|
|
|
|
|
|
|
|
|
|
# For the MIT Windows config files
|
|
|
|
|
Alias /ipa/config "/usr/share/ipa/html"
|
|
|
|
|
|
2007-09-25 07:37:45 -05:00
|
|
|
# Do no authentication on the directory that contains error messages
|
2007-09-24 14:20:34 -05:00
|
|
|
<Directory "/usr/share/ipa/html">
|
2010-02-23 11:53:47 -06:00
|
|
|
SetHandler None
|
2007-09-24 14:20:34 -05:00
|
|
|
AllowOverride None
|
|
|
|
|
Satisfy Any
|
2020-05-06 02:11:17 -05:00
|
|
|
Require all granted
|
2013-08-29 08:19:02 -05:00
|
|
|
ExpiresActive On
|
|
|
|
|
ExpiresDefault "access plus 0 seconds"
|
2007-09-24 14:20:34 -05:00
|
|
|
</Directory>
|
2007-09-25 07:37:45 -05:00
|
|
|
|
2010-02-23 11:53:47 -06:00
|
|
|
|
|
|
|
|
# For CRL publishing
|
2012-08-23 11:38:45 -05:00
|
|
|
Alias /ipa/crl "$CRL_PUBLISH_PATH"
|
|
|
|
|
<Directory "$CRL_PUBLISH_PATH">
|
2010-02-23 11:53:47 -06:00
|
|
|
SetHandler None
|
2009-08-24 12:42:48 -05:00
|
|
|
AllowOverride None
|
|
|
|
|
Options Indexes FollowSymLinks
|
|
|
|
|
Satisfy Any
|
2020-05-06 02:11:17 -05:00
|
|
|
Require all granted
|
2009-08-24 12:42:48 -05:00
|
|
|
</Directory>
|
|
|
|
|
|
2010-02-24 12:29:23 -06:00
|
|
|
|
2013-12-04 09:15:20 -06:00
|
|
|
# List explicitly only the fonts we want to serve
|
2019-04-17 06:52:53 -05:00
|
|
|
Alias /ipa/ui/fonts/open-sans "${FONTS_OPENSANS_DIR}"
|
|
|
|
|
Alias /ipa/ui/fonts/fontawesome "${FONTS_FONTAWESOME_DIR}"
|
2017-03-29 03:33:32 -05:00
|
|
|
<Directory "${FONTS_DIR}">
|
2013-12-04 09:15:20 -06:00
|
|
|
SetHandler None
|
|
|
|
|
AllowOverride None
|
|
|
|
|
Satisfy Any
|
2020-05-06 02:11:17 -05:00
|
|
|
Require all granted
|
2013-12-04 09:15:20 -06:00
|
|
|
ExpiresActive On
|
|
|
|
|
ExpiresDefault "access plus 1 year"
|
|
|
|
|
</Directory>
|
|
|
|
|
|
|
|
|
|
|
2010-08-06 14:43:27 -05:00
|
|
|
# webUI is now completely static, and served out of that directory
|
2011-01-19 11:26:14 -06:00
|
|
|
Alias /ipa/ui "/usr/share/ipa/ui"
|
|
|
|
|
<Directory "/usr/share/ipa/ui">
|
2010-08-03 18:42:03 -05:00
|
|
|
SetHandler None
|
|
|
|
|
AllowOverride None
|
2010-11-05 18:48:42 -05:00
|
|
|
Satisfy Any
|
2020-05-06 02:11:17 -05:00
|
|
|
Require all granted
|
2013-08-29 08:19:02 -05:00
|
|
|
ExpiresActive On
|
|
|
|
|
ExpiresDefault "access plus 1 year"
|
|
|
|
|
<FilesMatch "(index.html|loader.js|login.html|reset_password.html)">
|
|
|
|
|
ExpiresDefault "access plus 0 seconds"
|
|
|
|
|
</FilesMatch>
|
2010-08-03 18:42:03 -05:00
|
|
|
</Directory>
|
|
|
|
|
|
2013-04-23 12:54:21 -05:00
|
|
|
# Simple wsgi scripts required by ui
|
|
|
|
|
Alias /ipa/wsgi "/usr/share/ipa/wsgi"
|
|
|
|
|
<Directory "/usr/share/ipa/wsgi">
|
|
|
|
|
AllowOverride None
|
|
|
|
|
Satisfy Any
|
2020-05-06 02:11:17 -05:00
|
|
|
Require all granted
|
2013-04-23 12:54:21 -05:00
|
|
|
Options ExecCGI
|
|
|
|
|
AddHandler wsgi-script .py
|
|
|
|
|
</Directory>
|
2010-02-24 12:29:23 -06:00
|
|
|
|
2010-01-12 09:40:09 -06:00
|
|
|
# migration related pages
|
|
|
|
|
Alias /ipa/migration "/usr/share/ipa/migration"
|
|
|
|
|
<Directory "/usr/share/ipa/migration">
|
|
|
|
|
AllowOverride None
|
|
|
|
|
Satisfy Any
|
2020-05-06 02:11:17 -05:00
|
|
|
Require all granted
|
2010-10-29 08:38:17 -05:00
|
|
|
Options ExecCGI
|
|
|
|
|
AddHandler wsgi-script .py
|
2010-01-12 09:40:09 -06:00
|
|
|
</Directory>
|
